                                   META SWAP ENGINE

Le'me introduce my first meta swap engine. MSE engin :) MicroSoft Engin :)
Synatx:
                     call   meta_swap_engin, address, size_of_code
address - usually start address of code :)
size_of_code - how much you wanna meta swap
also code has capability to swap it-self but nothing special. Just chages lodsd/stosd and pushad/popad
inside of it, some xor reg/reg to sub reg/reg...
Also I use a pletny of macros inside of this code so I get enough space to change lodsd and ither inside
of it. Those macros can be found in meta.inc ...
To find instruction len, I use uNdErX's Micro Length-Disassembler Engine 32 which is very good :)
I also had to make one simple change in his code (ret to ret 4) b/c it used to screw stack inside of my
viri :)
To use this code just do this :

.586
.model flat, stdcall
...
.data
...
.code
...
                     call   meta_swap_engin, VA_of_virus, size_of_viri                 
include meta.asm

Also you MUST put mlde32.asm in same folder, b/c meta.asm uses it.
The best solution in using meta_swap engin is also to use z0mbies x_push/x_pop instead of 
Jack qwerty's @pushsz, with @pushsz you will get wrong instructions and your code won't be meta_swaped
as you expected (eg. maybe half of code will be swaped)
Well idea on using this is not to make AVs go crazy, but to fuckup signatures after they have added
virus signature in their database. 
Also I have to implement some random in range number generator so I can decide on fly if I'm gona meta
something or not. 
Code is quite simple, and I know that this is not the besto solution (talking with CPU at binary 
level), but I'm leraning this stuff so this is my first meta(If I may call it like that) engine.

What can this engin handle ->
@pushad macro
       pushad
       db 15 dup(90h)
endm 
will be chaged to pushes and with add [esp.Pushad_esp], 10h

@popad macro
       popad
       db 7 dup(90h)
endm
is going to be -> pop edi pop esi pop ebp pop ebx pop ebx pop edx pop ecx pop eax (I have 2 pop ebx)
or/test after api call are gona be swaped randomly
mov reg/reg will be chaged to push/pop and vice verse
xor reg/reg will be chaged to sub reg/reg and vice verse
lodsd will be chaged with mov eax, [esi], add esi, 4 and vice verse, same thing with stosd
and that's why I use a lot of @stosd/@lodsd macros in this code...

Well that's it, I'm little tired and wanna go sleep...
                                                        deroko <deroko<at>gmail<dot>com>
                                                        http://deroko.headcoders.net
 